C:\WINDOWS\system32\winlogon.exe contains Win32/Spy.Ursnif.A virus

I have NOD32 anti-virus that has been VERY good to me. I can not delete or remove this one virus. I have included my combo fix and HiJackThis log. I went into safe mode and ran malwarebytes and spybot but it did not help with this.

Download Kaspersky Boot CD from here: http://dnl-eu10.kaspersky-labs.com/devbuilds/RescueDisk/ and then burn the ISO file as an image on a CD. Boot your PC from it and let it scan your PC completely. After scanning is done, then boot in normal mode and scan once with MalwareBytes.

Let us know, how it goes. You had the TDSS rootkit in your computer, by the way.

I didn't analyze the CF log but I can see winlogon.exe and termsrv.dll (and possibly many others) failed the sigcheck.
A file patcher/file infector looks like it. I would second the suggestion of running DrWebCureit, or the Kaspersky boot CD then we'll see from there.

This will start the File Checker and Windows will check all the system files and replace any corrupt or missing files with fresh copies. This might require a Windows XP CD. That should bring back your system into a perfect working condition again (provided there are no more viruses left).

Featured Post

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

A while back when OPSMGR 2012 was released we were very excited about getting it into our environment and upgrading our 2007 implementation, we started our planning and we then proceeded with our implementation.
All went as planned & our system …

Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail. The methods are covered in more detail in o…